CVE-2020-16135: canonical ubuntu_linux NULL Pointer Dereference
CVSS: 5.9v3.1MediumModified
AliasesALPINE-CVE-2020-16135MGASA-2020-0324MGASA-2020-0338RHSA-2021:4387UBUNTU-CVE-2020-16135USN-4447-1DEBIAN-CVE-2020-16135DLA-2303-1
Published 29-07-2020Last modified 04-08-2024
Vulnerability summary
CVE-2020-16135 is a medium (CVSS 5.9) NULL Pointer Dereference vulnerability in canonical ubuntu_linux. EPSS estimates a 4.11% chance of exploitation in the next 30 days, higher than 90.6% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
5.9/10
010
Medium · v3.1 (NVD)EPSS score
4.11%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 29-07-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
libssh 0.9.4 has a NULL pointer dereference in tftpserver.c if ssh_buffer_new returns NULL.
CVSS metrics
6 scores · 5 sources · 2 versionsMedium 5.9Preferred score · NVD (NIST)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 5 agree
- OSV · AlpineEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Medium 4.3Preferred score · NVD (NIST)
AV:N/AC:M/Au:N/C:N/I:N/A:PSourcesSingle source
EPSS trend
Probability
4.11%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.11% on 18-09-2026
18-09-202618-10-2026
EPSS score4.11%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (bugs.libssh.org)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- libssh< 0:0.9.4-3.el8
- libssh-config< 0:0.9.4-3.el8
- libssh-debuginfo< 0:0.9.4-3.el8
- libssh-debugsource< 0:0.9.4-3.el8
- libssh-devel< 0:0.9.4-3.el8
Debian2 products
- libssh< 0.9.5-1 | < 0.7.3-2+deb9u3
- debian_linuxEOL9.0
Mageia2 products
- freerdp< 2.2.0-1.mga7
- libssh< 0.8.9-1.1.mga7
Alpine1 product
- libssh< 0.8.9-r1 | < 0.9.4-r1 | < 0.7.6-r3
Canonical1 product
- ubuntu_linuxEOL16.04 | 18.04 | 20.04
Fedoraproject1 product
- fedoraEOL32 | 33
Libssh1 product
- libssh0.9.4
Oracle1 product
Ubuntu1 product
- libssh< 0.6.3-4.3ubuntu0.6 | < 0.8.0~20170825.94fa1e38-1ubuntu0.7 | < 0.9.3-2ubuntu2.1
9 vendors · 15 products
References
33 links- bugs.libssh.org/rLIBSSHe631ebb3e2247dd25e9678e6827c20dc73b73238X Refsource MISCREPORTExploitIssue TrackingVendor Advisory
lists.debian.org/debian-lts-announce/2020/07/msg00034.htmlMailing ListX Refsource MLISTThird Party Advisory
Show all 33 references
- bugs.gentoo.org/734624ARTICLE
- gitlab.com/libssh/…REPORT
- gitlab.com/libssh/…REPORT
- gitlab.com/libssh/…REPORT
- gitlab.com/libssh/…REPORT